Adapter Access Control via Firmware Function Table
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing environments face challenges in controlling access to input/output adapters, particularly in systems not using memory mapped I/O, where ensuring authorized access to adapters is not effectively managed.
Innovation Solution
A computer program product that executes instructions to control access to adapters by using a function handle to obtain a function table entry, determining if the configuration is permitted access based on information in the entry, and allowing or denying access accordingly, ensuring only authorized configurations can access specific adapter functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional memory mapped I/O is used to control access to adapters, then access control is achieved through hardware-based address translation, but the system complexity increases and latency is introduced due to the need for page tables and address translation mechanisms
Solution Approach 1:
The patent extracts the access control functionality from the traditional memory mapped I/O address translation mechanisms. Instead of using hardware-based page tables and address translation, the invention introduces a firmware-based access control layer that intercepts and validates I/O requests before they reach the adapters. This separates the access control function from the address translation function, eliminating the need for complex page table structures while maintaining security.
Solution Approach 2:
The patent introduces an intermediary firmware component (such as a hypervisor or I/O manager) that sits between the operating systems and the adapters. This intermediary validates access requests using a data structure that maps adapter identifiers to authorized configurations, acting as a mediator that enables or disables adapter access without requiring the complexity of memory mapped I/O address translation mechanisms.
2Reliability
If memory mapped I/O with page tables is used for adapter access control, then authorized access is enforced, but access latency increases due to the translation overhead
Solution Approach 1:
The patent performs preliminary action by pre-establishing the access control data structure that maps adapter identifiers to authorized configurations during system initialization or configuration phase. This data structure is prepared in advance, so when I/O requests occur, the firmware can quickly validate access rights by simple table lookup without performing complex address translation operations in real-time, thereby reducing access latency while maintaining security.
3Adaptability or versatility
If partitions communicate to manage adapter access in virtualized environments, then flexible resource allocation is achieved, but communication overhead and complexity increase
Solution Approach 1:
The patent implements self-service by enabling each partition to independently manage its own adapter access rights through the firmware-based control mechanism. Each partition's operating system can request adapter access, and the firmware automatically validates the request against the pre-configured access control data structure. This eliminates the need for complex inter-partition communication protocols and centralized management overhead, as each partition serves itself while maintaining overall system security and flexibility.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Access to an input/output adapter by a configuration is controlled. For each requested access to an adapter, checks are made to determine whether the configuration is authorized to access the adapter. If it is not authorized, then access is denied. If it is authorized, but access should be temporarily blocked, then instruction execution is altered to indicate such. If access is permitted, but should be blocked for another reason (other than temporarily), 10 then access is denied.